2,612 karma · joined May 15, 2008
from the article: "A Facebook spokesperson said it also collects that data to help it tailor and target its ads. For example, the company might use it to help an app developer target ads to users that have already downloaded that developer’s other apps."
Hi Simon. Why do you think that pn will be so important? I have Cyanogenmod without google apps, and I don't miss pn one bit. I understand that I am not the typical user, but what do you see in pn that I don't?
Google has been the Firefox global search default since 2004. Our agreement came up for renewal this year, and we took this as an opportunity to review our competitive strategy and explore our options.
In evaluating our search partnerships, our primary consideration was to ensure our strategy aligned with our values of choice and independence, and positions us to innovate and advance our mission in ways that best serve our users and the Web. In the end, each of the partnership options available to us had strong, improved economic terms reflecting the significant value that Firefox brings to the ecosystem. But one strategy stood out from the rest.
And it was completely offline (even the routing algorithm) and free.
sounds almost like http://openjdk.java.net/projects/nashorn/
https://www.trustedsec.com/september-2014/shellshock-dhcp-rc...
On the internet you are never the only one. I don't like it either, but it's just subjective opinion. I'm sure a lot of people will like it.
that is a good thing: if the first message contains something else that is not just "poke", it's spam.
Why? Couldn't spammers encrypt the mail they send to you just like everybody else?
- npm
- firefox
- firebug
- grunt
- git
- jenkins
- javascriptmvc
which in turn must be signed by the zone operator (e.g.: Verisign for .com) who publishes them in DNS. So we still have Central Authorities - in the sense that there is still some overlord controlling everything.
With CT we still have to trust CAs. Basically forever.
There is no need for a UI in Convergence that I know of? What part are you talking about?
> and fundamentally it's just the CA model with very short lived constantly renewed certificates.
I don't understand what you are referring to. There are no "short lived constantly renewed certificates" in Convergence.
Maybe you mean something else
But unfortunately she does not take TACK/pinning + Convergence in consideration.
Yes I did. Thanks for clarifying.
> The existing CA system doesn't solve this.
So that's why Moxie is pushing for TACK. Now I understand how all works together.
> The attacker that can control a TLD is the sort that can control a CA. But you're claiming Convergence would fix it.
No I don't. I didn't even think about that scenario.
Thanks for the discussion. HN is awesome.
No! Certificate Transparency still relays on central authorities. We need to get rid of CAs. TACK + Convergence is the correct solution.
Notary requests use TLS too: If an attacker redirects my requests to other (untrusted) notaries my client will complain because it has the (self-signed) certs of the notaries cached. I can buy two or more servers in different counties, install the notary server on them, copy&paste the cert of the notaries in my client, and from that moment on Convergence works and my TLS connections are secure.
> Convergence also requires client support on all the clients before you can stop using CA-signed certificates, which isn't going to happen quickly.
Clients that use Convergence are effectively CA free from the moment they install it. The others can follow incrementally.
> A CA (or someone who bought an intermediary CA certificate from an existing CA) could set up the thing I described in a matter of hours and henceforth anybody who needs a domain validated TLS certificate could get one instantly, securely and for free by just adding a DNS record and visiting that website.
Notary certs are self signed. A browser vendor could set up a few notary servers that use certs they signed themselves and ship with them by default. Browser vendors already ship with the CA certs, so instead of the CA certs they would ship with their own cert that signed the ones the notaries use. If you don't trust them use your own notaries no problem. Everything works like before. I just think it's an awesome idea.
DNSSEC still has a central trust anchor that signs the records. Convergence is completely distributed.
http://convergence.io/ is (was?) a great idea and technical implementation of it, I installed two notaries on two different servers I own, and it worked great. It seems dead now. Don't know why.
I think that if you do this you are one RewriteRule away from doing it right.
> In my experience[1], putting Nginx in front of Apache to serve static assets and leaving Apache as a sort of application server
I also think that using nginx only for static content is wasting perfectly good resources for nothing. Apache can serve static assets just as good as nginx does. No need for an other layer in your stack.
Apache does not fork a new process to handle a request. Not even in prefork mode.
Thanks KDE Team. I love you.
Probably it went something like this:
Eliezer: I give you 100$ if you write on the list that you let me out
Nathan: Done.